With the requirements of Intelligent Transport Systems (ITSs) for extensive
connectivity of Electronic Control Units (ECUs) to the outside world, safety
and security have become stringent problems. Intrusion detection systems (IDSs)
are a crucial safety component in remediating Controller Area Network (CAN) bus
vulnerabilities. However, supervised-based IDSs fail to identify complexity
attacks and anomaly-based IDSs have higher false alarms owing to capability
bottleneck. In this paper, we propose a novel multi-knowledge fused anomaly
detection model, called MKF-IDS. Specifically, the method designs an
integration framework, including spatial-temporal correlation with an attention
mechanism (STcAM) module and patch sparse-transformer module (PatchST). The
STcAM with fine-pruning uses one-dimensional convolution (Conv1D) to extract
spatial features and subsequently utilizes the Bidirectional Long Short Term
Memory (Bi-LSTM) to extract the temporal features, where the attention
mechanism will focus on the important time steps. Meanwhile, the PatchST
captures the combined long-time historical features from independent univariate
time series. Finally, the proposed method is based on knowledge distillation to
STcAM as a student model for learning intrinsic knowledge and cross the ability
to mimic PatchST. In the detection phase, the MKF-ADS only deploys STcAM to
maintain efficiency in a resource-limited IVN environment. Moreover, the
redundant noisy signal is reduced with bit flip rate and boundary decision
estimation. We conduct extensive experiments on six simulation attack scenarios
across various CAN IDs and time steps, and two real attack scenarios, which
present a competitive prediction and detection performance. Compared with the
baseline in the same paradigm, the error rate and FAR are 2.62% and 2.41% and
achieve a promising F1-score of 97.3%.

在本文中，我们提出了一种新颖的多知识融合异常检测模型 MKF-IDS，该模型具备强大的预测和检测性能，通过空时关联和知识蒸馏等技术对智能交通系统中的安全问题进行解决。